Loading story…
Scattered Spider—also tracked as UNC3944, 0ktapus, Muddled Libra, and Scatter Swine—has broadened its operations from telecom-focused credential theft and SIM swapping into ransomware, extortion, and cloud-centric intrusions across hospitality, retail, media, financial services, BPOs, and parts of critical infrastructure. Reporting links the group to major incidents involving Twilio, Okta customers, Coinbase, Reddit, Riot Games, Ubiquiti, and MGM Resorts, where attackers used convincing phone calls, SMS phishing, MFA fatigue, and IT help-desk impersonation to steal credentials and gain privileged access.
Researchers say the group routinely abuses legitimate remote administration tools including AnyDesk, LogMeIn, and ConnectWise Control, while also using malware such as POORTRY and STONESTOP to disable security controls and maintain access across Azure, Microsoft 365, Google Workspace, AWS, Windows, and Linux environments. Defenders have been urged to audit and restrict remote access software, review logs for unauthorized execution, harden MFA enrollment and help-desk identity verification, and monitor for in-memory loading, suspicious MFA registration, and data exfiltration activity tied to the group’s tradecraft.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
11 events from the most recent confirmed update back to the earliest known activity.
By June 2025, Mandiant and Palo Alto Networks said they had observed multiple airline and transportation intrusions resembling Scattered Spider/UNC3944 activity and warned the sector to harden systems. Axios linked the trend to recent incidents affecting Hawaiian Airlines and WestJet, with a source saying Scattered Spider was likely behind the WestJet intrusion.
Researchers and authorities linked Scattered Spider to the MGM Resorts attack in September, where attackers reportedly posed as an employee and called the company's help desk to gain access. Barracuda says the incident involved collaboration with ALPHV and theft of customer and financial data, while The Record notes it caused operational disruption at several Las Vegas hotels.
Mandiant said UNC3944 had evolved from data theft into ransomware operations and began deploying ransomware in victim environments by the middle of 2023.
By January 2023, Trellix says Scattered Spider had been involved in more than half a dozen incidents targeting large outsourcing firms serving high-value cryptocurrency institutions and individuals.
In December 2022, Scattered Spider's use of attestation signing to sign malware was discovered. Trellix says Microsoft responded by blocking the malicious drivers and suspending accounts used to publish them through the Windows Hardware Developer Program.
Barracuda says Scattered Spider attacked Ubiquiti Networks in December 2022 by phishing an employee and stealing credentials. The intrusion reportedly led to theft of source code, customer information, and financial records, and Ubiquiti shut down systems for several days and lost millions in revenue.
In December 2022, Scattered Spider conducted persistent campaigns against telecommunications and business process outsourcing organizations, aiming to gain access to carrier networks and perform SIM swapping. Trellix says the group used calls and texts impersonating IT staff to direct victims to credential-harvesting sites or commercial remote management tools.
In August 2022, Twilio identified unauthorized access to information related to 163 customers, including Okta. Trellix attributes the activity to Scattered Spider and says the attackers accessed phone numbers and SMS one-time passwords through the Twilio console.
Trellix says Scattered Spider, also tracked as UNC3944, Scatter Swine, and Muddled Libra, has been active since at least May 2022.
CISA issued a bulletin warning that Scattered Spider targets large companies and contracted IT help desks, engages in data theft for extortion, and has used BlackCat/ALPHV ransomware alongside its usual tactics.
Group-IB reported that a phishing campaign attributed to the group compromised 9,931 accounts across more than 136 organizations, including Riot Games, Reddit, and Twilio.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
trellix.com
Open sourceaxios.com
Open sourceblog.barracuda.com
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. Department of Health and Human Services' Health Sector Cybersecurity Coordination Center (**HC3**) warned that **Scattered Spider** is actively targeting healthcare and other industries with sophisticated social engineering, including help-desk impersonation, phishing, MFA fatigue, SIM swapping, and AI-assisted lures. The financially motivated group—also tracked as **Octo Tempest**, **UNC3944**, **0ktapus**, and **Muddled Libra**—has built a reputation for using native English-speaking operators to trick employees and IT staff into resetting passwords, enrolling attacker-controlled MFA devices, and granting remote access. Federal guidance says the actors often abuse trusted tools and cloud services after initial access, making intrusions harder to distinguish from legitimate activity. U.S. agencies and private-sector researchers have linked Scattered Spider to data theft, extortion, and collaboration with **ALPHV/BlackCat** ransomware operations, with victims spanning hospitality, gaming, retail, technology, and now heightened concern for healthcare organizations. Microsoft and the FBI/CISA have described the group as unusually dangerous because it combines persuasive phone-based deception with credential theft, reconnaissance, privilege escalation, mailbox manipulation, and deployment of ransomware on Windows, Linux, and **VMware ESXi** environments. Authorities have also tied the group to major incidents including attacks on MGM Resorts and Caesars, while UK investigators later examined whether Scattered Spider was connected to disruptive cyberattacks against retailers.
Jun 29, 2026
CrowdStrike reported that two financially motivated threat groups tied to **The Com** — **Cordial Spider** and **Snarky Spider** — are carrying out rapid data-theft and extortion campaigns against U.S.-based organizations across critical infrastructure and enterprise sectors, including aviation, retail, hospitality, financial services, legal, technology, automotive, and academia. The actors are closely aligned with the **Scattered Spider** playbook and have used voice phishing, text messages, email, and other social-engineering tactics since at least October 2025 to compromise identity platforms, steal credentials, session keys, and tokens, and pivot through victims’ SaaS environments. Ransom demands have reportedly reached seven figures, and some victims have also faced **DDoS** attacks or swatting. The intrusions rely on adversary-in-the-middle phishing pages that mimic legitimate single sign-on and identity-provider portals, enabling access to services such as **SharePoint**, **HubSpot**, and **Google Workspace** while largely bypassing traditional endpoint defenses. After gaining access, the attackers register their own MFA devices or emulators, disable or suppress alerts through inbox rules and email deletion, and move quickly to search for sensitive data and exfiltrate it, in some cases within an hour of initial access. Researchers said the groups differ in tradecraft — including operating hours, phishing infrastructure, leak sites, and MFA-registration methods — while both use commercial VPNs and residential proxy networks such as **Mullvad**, **Oxylabs**, **NetNut**, **9Proxy**, **Infatica**, and **NSOCKS** to blend into normal traffic and evade detection.
Jun 29, 2026
Group-IB reported that **Scattered Spider** is better understood as a decentralized cybercrime collective rather than a single, tightly organized threat group. The company said multiple small, independent subclusters share tactics, tools, and social-engineering tradecraft, including phishing pages impersonating **Okta** and other identity providers, along with **vishing**, **smishing**, **SIM swapping**, and remote-access tooling to gain access to enterprise environments. The report linked these subclusters to intrusions affecting telecoms, marketing and communications providers, enterprises, cryptocurrency users and firms, BPOs, and support organizations, and associated the broader ecosystem with incidents involving **Twilio** customers, **Riot Games**, **MGM**, **Caesars**, **Co-op**, and **Marks & Spencer**. Group-IB also highlighted overlap with aliases including **0ktapus**, **UNC3944**, **Muddled Libra**, and **Octo Tempest**, warning that arrests of individual actors are unlikely to dismantle the threat because separate operators can continue working independently.
Aug 11, 2026